cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

drm_hdcp_helper.c (12310B)


      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 * Copyright (C) 2019 Intel Corporation.
      4 *
      5 * Authors:
      6 * Ramalingam C <ramalingam.c@intel.com>
      7 */
      8
      9#include <linux/device.h>
     10#include <linux/err.h>
     11#include <linux/gfp.h>
     12#include <linux/export.h>
     13#include <linux/slab.h>
     14#include <linux/firmware.h>
     15
     16#include <drm/display/drm_hdcp_helper.h>
     17#include <drm/drm_sysfs.h>
     18#include <drm/drm_print.h>
     19#include <drm/drm_device.h>
     20#include <drm/drm_property.h>
     21#include <drm/drm_mode_object.h>
     22#include <drm/drm_connector.h>
     23
     24static inline void drm_hdcp_print_ksv(const u8 *ksv)
     25{
     26	DRM_DEBUG("\t%#02x, %#02x, %#02x, %#02x, %#02x\n",
     27		  ksv[0], ksv[1], ksv[2], ksv[3], ksv[4]);
     28}
     29
     30static u32 drm_hdcp_get_revoked_ksv_count(const u8 *buf, u32 vrls_length)
     31{
     32	u32 parsed_bytes = 0, ksv_count = 0, vrl_ksv_cnt, vrl_sz;
     33
     34	while (parsed_bytes < vrls_length) {
     35		vrl_ksv_cnt = *buf;
     36		ksv_count += vrl_ksv_cnt;
     37
     38		vrl_sz = (vrl_ksv_cnt * DRM_HDCP_KSV_LEN) + 1;
     39		buf += vrl_sz;
     40		parsed_bytes += vrl_sz;
     41	}
     42
     43	/*
     44	 * When vrls are not valid, ksvs are not considered.
     45	 * Hence SRM will be discarded.
     46	 */
     47	if (parsed_bytes != vrls_length)
     48		ksv_count = 0;
     49
     50	return ksv_count;
     51}
     52
     53static u32 drm_hdcp_get_revoked_ksvs(const u8 *buf, u8 **revoked_ksv_list,
     54				     u32 vrls_length)
     55{
     56	u32 vrl_ksv_cnt, vrl_ksv_sz, vrl_idx = 0;
     57	u32 parsed_bytes = 0, ksv_count = 0;
     58
     59	do {
     60		vrl_ksv_cnt = *buf;
     61		vrl_ksv_sz = vrl_ksv_cnt * DRM_HDCP_KSV_LEN;
     62
     63		buf++;
     64
     65		DRM_DEBUG("vrl: %d, Revoked KSVs: %d\n", vrl_idx++,
     66			  vrl_ksv_cnt);
     67		memcpy((*revoked_ksv_list) + (ksv_count * DRM_HDCP_KSV_LEN),
     68		       buf, vrl_ksv_sz);
     69
     70		ksv_count += vrl_ksv_cnt;
     71		buf += vrl_ksv_sz;
     72
     73		parsed_bytes += (vrl_ksv_sz + 1);
     74	} while (parsed_bytes < vrls_length);
     75
     76	return ksv_count;
     77}
     78
     79static inline u32 get_vrl_length(const u8 *buf)
     80{
     81	return drm_hdcp_be24_to_cpu(buf);
     82}
     83
     84static int drm_hdcp_parse_hdcp1_srm(const u8 *buf, size_t count,
     85				    u8 **revoked_ksv_list, u32 *revoked_ksv_cnt)
     86{
     87	struct hdcp_srm_header *header;
     88	u32 vrl_length, ksv_count;
     89
     90	if (count < (sizeof(struct hdcp_srm_header) +
     91	    DRM_HDCP_1_4_VRL_LENGTH_SIZE + DRM_HDCP_1_4_DCP_SIG_SIZE)) {
     92		DRM_ERROR("Invalid blob length\n");
     93		return -EINVAL;
     94	}
     95
     96	header = (struct hdcp_srm_header *)buf;
     97	DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n",
     98		  header->srm_id,
     99		  be16_to_cpu(header->srm_version), header->srm_gen_no);
    100
    101	WARN_ON(header->reserved);
    102
    103	buf = buf + sizeof(*header);
    104	vrl_length = get_vrl_length(buf);
    105	if (count < (sizeof(struct hdcp_srm_header) + vrl_length) ||
    106	    vrl_length < (DRM_HDCP_1_4_VRL_LENGTH_SIZE +
    107			  DRM_HDCP_1_4_DCP_SIG_SIZE)) {
    108		DRM_ERROR("Invalid blob length or vrl length\n");
    109		return -EINVAL;
    110	}
    111
    112	/* Length of the all vrls combined */
    113	vrl_length -= (DRM_HDCP_1_4_VRL_LENGTH_SIZE +
    114		       DRM_HDCP_1_4_DCP_SIG_SIZE);
    115
    116	if (!vrl_length) {
    117		DRM_ERROR("No vrl found\n");
    118		return -EINVAL;
    119	}
    120
    121	buf += DRM_HDCP_1_4_VRL_LENGTH_SIZE;
    122	ksv_count = drm_hdcp_get_revoked_ksv_count(buf, vrl_length);
    123	if (!ksv_count) {
    124		DRM_DEBUG("Revoked KSV count is 0\n");
    125		return 0;
    126	}
    127
    128	*revoked_ksv_list = kcalloc(ksv_count, DRM_HDCP_KSV_LEN, GFP_KERNEL);
    129	if (!*revoked_ksv_list) {
    130		DRM_ERROR("Out of Memory\n");
    131		return -ENOMEM;
    132	}
    133
    134	if (drm_hdcp_get_revoked_ksvs(buf, revoked_ksv_list,
    135				      vrl_length) != ksv_count) {
    136		*revoked_ksv_cnt = 0;
    137		kfree(*revoked_ksv_list);
    138		return -EINVAL;
    139	}
    140
    141	*revoked_ksv_cnt = ksv_count;
    142	return 0;
    143}
    144
    145static int drm_hdcp_parse_hdcp2_srm(const u8 *buf, size_t count,
    146				    u8 **revoked_ksv_list, u32 *revoked_ksv_cnt)
    147{
    148	struct hdcp_srm_header *header;
    149	u32 vrl_length, ksv_count, ksv_sz;
    150
    151	if (count < (sizeof(struct hdcp_srm_header) +
    152	    DRM_HDCP_2_VRL_LENGTH_SIZE + DRM_HDCP_2_DCP_SIG_SIZE)) {
    153		DRM_ERROR("Invalid blob length\n");
    154		return -EINVAL;
    155	}
    156
    157	header = (struct hdcp_srm_header *)buf;
    158	DRM_DEBUG("SRM ID: 0x%x, SRM Ver: 0x%x, SRM Gen No: 0x%x\n",
    159		  header->srm_id & DRM_HDCP_SRM_ID_MASK,
    160		  be16_to_cpu(header->srm_version), header->srm_gen_no);
    161
    162	if (header->reserved)
    163		return -EINVAL;
    164
    165	buf = buf + sizeof(*header);
    166	vrl_length = get_vrl_length(buf);
    167
    168	if (count < (sizeof(struct hdcp_srm_header) + vrl_length) ||
    169	    vrl_length < (DRM_HDCP_2_VRL_LENGTH_SIZE +
    170	    DRM_HDCP_2_DCP_SIG_SIZE)) {
    171		DRM_ERROR("Invalid blob length or vrl length\n");
    172		return -EINVAL;
    173	}
    174
    175	/* Length of the all vrls combined */
    176	vrl_length -= (DRM_HDCP_2_VRL_LENGTH_SIZE +
    177		       DRM_HDCP_2_DCP_SIG_SIZE);
    178
    179	if (!vrl_length) {
    180		DRM_ERROR("No vrl found\n");
    181		return -EINVAL;
    182	}
    183
    184	buf += DRM_HDCP_2_VRL_LENGTH_SIZE;
    185	ksv_count = (*buf << 2) | DRM_HDCP_2_KSV_COUNT_2_LSBITS(*(buf + 1));
    186	if (!ksv_count) {
    187		DRM_DEBUG("Revoked KSV count is 0\n");
    188		return 0;
    189	}
    190
    191	*revoked_ksv_list = kcalloc(ksv_count, DRM_HDCP_KSV_LEN, GFP_KERNEL);
    192	if (!*revoked_ksv_list) {
    193		DRM_ERROR("Out of Memory\n");
    194		return -ENOMEM;
    195	}
    196
    197	ksv_sz = ksv_count * DRM_HDCP_KSV_LEN;
    198	buf += DRM_HDCP_2_NO_OF_DEV_PLUS_RESERVED_SZ;
    199
    200	DRM_DEBUG("Revoked KSVs: %d\n", ksv_count);
    201	memcpy(*revoked_ksv_list, buf, ksv_sz);
    202
    203	*revoked_ksv_cnt = ksv_count;
    204	return 0;
    205}
    206
    207static inline bool is_srm_version_hdcp1(const u8 *buf)
    208{
    209	return *buf == (u8)(DRM_HDCP_1_4_SRM_ID << 4);
    210}
    211
    212static inline bool is_srm_version_hdcp2(const u8 *buf)
    213{
    214	return *buf == (u8)(DRM_HDCP_2_SRM_ID << 4 | DRM_HDCP_2_INDICATOR);
    215}
    216
    217static int drm_hdcp_srm_update(const u8 *buf, size_t count,
    218			       u8 **revoked_ksv_list, u32 *revoked_ksv_cnt)
    219{
    220	if (count < sizeof(struct hdcp_srm_header))
    221		return -EINVAL;
    222
    223	if (is_srm_version_hdcp1(buf))
    224		return drm_hdcp_parse_hdcp1_srm(buf, count, revoked_ksv_list,
    225						revoked_ksv_cnt);
    226	else if (is_srm_version_hdcp2(buf))
    227		return drm_hdcp_parse_hdcp2_srm(buf, count, revoked_ksv_list,
    228						revoked_ksv_cnt);
    229	else
    230		return -EINVAL;
    231}
    232
    233static int drm_hdcp_request_srm(struct drm_device *drm_dev,
    234				u8 **revoked_ksv_list, u32 *revoked_ksv_cnt)
    235{
    236	char fw_name[36] = "display_hdcp_srm.bin";
    237	const struct firmware *fw;
    238	int ret;
    239
    240	ret = request_firmware_direct(&fw, (const char *)fw_name,
    241				      drm_dev->dev);
    242	if (ret < 0) {
    243		*revoked_ksv_cnt = 0;
    244		*revoked_ksv_list = NULL;
    245		ret = 0;
    246		goto exit;
    247	}
    248
    249	if (fw->size && fw->data)
    250		ret = drm_hdcp_srm_update(fw->data, fw->size, revoked_ksv_list,
    251					  revoked_ksv_cnt);
    252
    253exit:
    254	release_firmware(fw);
    255	return ret;
    256}
    257
    258/**
    259 * drm_hdcp_check_ksvs_revoked - Check the revoked status of the IDs
    260 *
    261 * @drm_dev: drm_device for which HDCP revocation check is requested
    262 * @ksvs: List of KSVs (HDCP receiver IDs)
    263 * @ksv_count: KSV count passed in through @ksvs
    264 *
    265 * This function reads the HDCP System renewability Message(SRM Table)
    266 * from userspace as a firmware and parses it for the revoked HDCP
    267 * KSVs(Receiver IDs) detected by DCP LLC. Once the revoked KSVs are known,
    268 * revoked state of the KSVs in the list passed in by display drivers are
    269 * decided and response is sent.
    270 *
    271 * SRM should be presented in the name of "display_hdcp_srm.bin".
    272 *
    273 * Format of the SRM table, that userspace needs to write into the binary file,
    274 * is defined at:
    275 * 1. Renewability chapter on 55th page of HDCP 1.4 specification
    276 * https://www.digital-cp.com/sites/default/files/specifications/HDCP%20Specification%20Rev1_4_Secure.pdf
    277 * 2. Renewability chapter on 63rd page of HDCP 2.2 specification
    278 * https://www.digital-cp.com/sites/default/files/specifications/HDCP%20on%20HDMI%20Specification%20Rev2_2_Final1.pdf
    279 *
    280 * Returns:
    281 * Count of the revoked KSVs or -ve error number in case of the failure.
    282 */
    283int drm_hdcp_check_ksvs_revoked(struct drm_device *drm_dev, u8 *ksvs,
    284				u32 ksv_count)
    285{
    286	u32 revoked_ksv_cnt = 0, i, j;
    287	u8 *revoked_ksv_list = NULL;
    288	int ret = 0;
    289
    290	ret = drm_hdcp_request_srm(drm_dev, &revoked_ksv_list,
    291				   &revoked_ksv_cnt);
    292	if (ret)
    293		return ret;
    294
    295	/* revoked_ksv_cnt will be zero when above function failed */
    296	for (i = 0; i < revoked_ksv_cnt; i++)
    297		for  (j = 0; j < ksv_count; j++)
    298			if (!memcmp(&ksvs[j * DRM_HDCP_KSV_LEN],
    299				    &revoked_ksv_list[i * DRM_HDCP_KSV_LEN],
    300				    DRM_HDCP_KSV_LEN)) {
    301				DRM_DEBUG("Revoked KSV is ");
    302				drm_hdcp_print_ksv(&ksvs[j * DRM_HDCP_KSV_LEN]);
    303				ret++;
    304			}
    305
    306	kfree(revoked_ksv_list);
    307	return ret;
    308}
    309EXPORT_SYMBOL_GPL(drm_hdcp_check_ksvs_revoked);
    310
    311static struct drm_prop_enum_list drm_cp_enum_list[] = {
    312	{ DRM_MODE_CONTENT_PROTECTION_UNDESIRED, "Undesired" },
    313	{ DRM_MODE_CONTENT_PROTECTION_DESIRED, "Desired" },
    314	{ DRM_MODE_CONTENT_PROTECTION_ENABLED, "Enabled" },
    315};
    316DRM_ENUM_NAME_FN(drm_get_content_protection_name, drm_cp_enum_list)
    317
    318static struct drm_prop_enum_list drm_hdcp_content_type_enum_list[] = {
    319	{ DRM_MODE_HDCP_CONTENT_TYPE0, "HDCP Type0" },
    320	{ DRM_MODE_HDCP_CONTENT_TYPE1, "HDCP Type1" },
    321};
    322DRM_ENUM_NAME_FN(drm_get_hdcp_content_type_name,
    323		 drm_hdcp_content_type_enum_list)
    324
    325/**
    326 * drm_connector_attach_content_protection_property - attach content protection
    327 * property
    328 *
    329 * @connector: connector to attach CP property on.
    330 * @hdcp_content_type: is HDCP Content Type property needed for connector
    331 *
    332 * This is used to add support for content protection on select connectors.
    333 * Content Protection is intentionally vague to allow for different underlying
    334 * technologies, however it is most implemented by HDCP.
    335 *
    336 * When hdcp_content_type is true enum property called HDCP Content Type is
    337 * created (if it is not already) and attached to the connector.
    338 *
    339 * This property is used for sending the protected content's stream type
    340 * from userspace to kernel on selected connectors. Protected content provider
    341 * will decide their type of their content and declare the same to kernel.
    342 *
    343 * Content type will be used during the HDCP 2.2 authentication.
    344 * Content type will be set to &drm_connector_state.hdcp_content_type.
    345 *
    346 * The content protection will be set to &drm_connector_state.content_protection
    347 *
    348 * When kernel triggered content protection state change like DESIRED->ENABLED
    349 * and ENABLED->DESIRED, will use drm_hdcp_update_content_protection() to update
    350 * the content protection state of a connector.
    351 *
    352 * Returns:
    353 * Zero on success, negative errno on failure.
    354 */
    355int drm_connector_attach_content_protection_property(
    356		struct drm_connector *connector, bool hdcp_content_type)
    357{
    358	struct drm_device *dev = connector->dev;
    359	struct drm_property *prop =
    360			dev->mode_config.content_protection_property;
    361
    362	if (!prop)
    363		prop = drm_property_create_enum(dev, 0, "Content Protection",
    364						drm_cp_enum_list,
    365						ARRAY_SIZE(drm_cp_enum_list));
    366	if (!prop)
    367		return -ENOMEM;
    368
    369	drm_object_attach_property(&connector->base, prop,
    370				   DRM_MODE_CONTENT_PROTECTION_UNDESIRED);
    371	dev->mode_config.content_protection_property = prop;
    372
    373	if (!hdcp_content_type)
    374		return 0;
    375
    376	prop = dev->mode_config.hdcp_content_type_property;
    377	if (!prop)
    378		prop = drm_property_create_enum(dev, 0, "HDCP Content Type",
    379					drm_hdcp_content_type_enum_list,
    380					ARRAY_SIZE(
    381					drm_hdcp_content_type_enum_list));
    382	if (!prop)
    383		return -ENOMEM;
    384
    385	drm_object_attach_property(&connector->base, prop,
    386				   DRM_MODE_HDCP_CONTENT_TYPE0);
    387	dev->mode_config.hdcp_content_type_property = prop;
    388
    389	return 0;
    390}
    391EXPORT_SYMBOL(drm_connector_attach_content_protection_property);
    392
    393/**
    394 * drm_hdcp_update_content_protection - Updates the content protection state
    395 * of a connector
    396 *
    397 * @connector: drm_connector on which content protection state needs an update
    398 * @val: New state of the content protection property
    399 *
    400 * This function can be used by display drivers, to update the kernel triggered
    401 * content protection state changes of a drm_connector such as DESIRED->ENABLED
    402 * and ENABLED->DESIRED. No uevent for DESIRED->UNDESIRED or ENABLED->UNDESIRED,
    403 * as userspace is triggering such state change and kernel performs it without
    404 * fail.This function update the new state of the property into the connector's
    405 * state and generate an uevent to notify the userspace.
    406 */
    407void drm_hdcp_update_content_protection(struct drm_connector *connector,
    408					u64 val)
    409{
    410	struct drm_device *dev = connector->dev;
    411	struct drm_connector_state *state = connector->state;
    412
    413	WARN_ON(!drm_modeset_is_locked(&dev->mode_config.connection_mutex));
    414	if (state->content_protection == val)
    415		return;
    416
    417	state->content_protection = val;
    418	drm_sysfs_connector_status_event(connector,
    419				 dev->mode_config.content_protection_property);
    420}
    421EXPORT_SYMBOL(drm_hdcp_update_content_protection);